pending anonymous user

  • 2 Posts
  • 17 Comments
Joined 2 years ago
cake
Cake day: August 7th, 2023

help-circle







  • Despite the bad title, the article itself is worth a read, though the topics covered are being discussed long ago, but serves as a good reminder.

    A point the author raises is about data security in end-to-end encrypted communications when using with AI. Remember that end-to-end encryption is specifically protecting data in transit? It doesn’t do anything after the data is delivered to the end device. Even before the age of “AI”, the other end can do whatever he wants on that piece of data. He can shared the communication with another person next to him which the sender might or might not know of, upload it to social media, or hand it to the law enforcement. And the “AI” the tech industry going forward is just an other participant of the communication built right into the device. It can do exactly the same as any recipients wants to. It can attempt to try to (badly) summarize the communication for you, submit that communication to any third party, or even report you for CSAM as it determines your engaging in “grooming behavior.”

    And the author also asked the question, “Who does your AI agent actually work for?” However, this question is already been answered by Windows Recall, the prime example of an AI agent. It collects data in an attempt to “help” us recall things in the past, but it will answer questions from anyone have access to it. Be it, you, your family/friend, or even law enforcement. The answer is anyone.






  • That scanner is simply looking for high entropy data, and then report to its operator. It wouldn’t care if it is a drive or a volume or a file. If the entropy is high, flag it.

    All random data have high entropy, same for encrypted data. The officer can see you have high entropy data then start throwing questions at you.

    This community need better understanding of cryptography and how it translates to real world. Deniable encryption exists and does work on paper, but only on paper.



  • The point is they don’t have to proof if a piece of random data is indeed an encrypted blob.

    Imagine you passing border security and got selected for search. They found a piece of data on your device with high entropy without known headers in the wrong place. You can claim you know nothing about it, yet they can speculate the heck out of you. In more civil nations, you might got on to a watch list. In a more authoritive nations, they can just detain you.

    They don’t have to prove you hiding something. The mere fact of you have that piece of high entroy data is a clue to them, and they have the power to make your life hard. Oh you said you deny them for a search? First congrats you still have a choice, and secondly that’s also a clue to them.

    For more info, read cryptsetup FAQ section 5.2 paragraph 3, 5.18, and 5.21. It is written by Milan Brož who is way more experienced than me on this matter.